build(deps): bump the go_modules group across 3 directories with 19 updates by dependabot[bot] · Pull Request #83 · testfailed/sourcegraph

dependabot · 2024-05-07T13:12:18Z

Bumps the go_modules group with 12 updates in the / directory:

Package	From	To
github.com/crewjam/saml	`0.4.1`	`0.4.14`
github.com/graph-gophers/graphql-go	`0.0.0-20201113091052-beb923fada29`	`1.3.0`
github.com/graphql-go/graphql	`0.7.9`	`0.8.1`
github.com/jackc/pgx/v4	`4.13.0`	`4.18.2`
github.com/microcosm-cc/bluemonday	`1.0.4`	`1.0.26`
github.com/prometheus/client_golang	`1.11.0`	`1.11.1`
github.com/tidwall/gjson	`1.8.1`	`1.9.3`
google.golang.org/protobuf	`1.27.1`	`1.33.0`
k8s.io/apimachinery	`0.17.0`	`0.17.9`
k8s.io/client-go	`0.17.0`	`0.17.16`
github.com/go-git/go-git/v5	`5.4.2`	`5.11.0`
google.golang.org/grpc	`1.40.0`	`1.56.3`

Bumps the go_modules group with 1 update in the /dev/sg directory: github.com/jackc/pgx/v4.
Bumps the go_modules group with 2 updates in the /lib directory: golang.org/x/sys and gopkg.in/yaml.v3.

Updates github.com/crewjam/saml from 0.4.1 to 0.4.14

Commits

b07b16c Merge pull request from GHSA-267v-3v32-g6q5
5f6e5ab Bump golang.org/x/crypto (#538)
193e551 update for most recent three go versions (#537)
34930b2 Add support for hardware security module (HSM) signing. (#503)
f9e6716 Update golangci-lint version, linting fixes. (#511)
8e92368 Merge pull request from GHSA-5mqj-xc49-246p
2aeb2ef Update README example to use displayName attribute (#486)
5049389 Bump github.com/kr/pretty from 0.3.0 to 0.3.1 (#484)
73bf1ff Bump github.com/stretchr/testify from 1.6.1 to 1.8.1 (#483)
cfc9c75 Bump github.com/golang-jwt/jwt/v4 from 4.4.2 to 4.4.3 (#467)
Additional commits viewable in compare view

Updates github.com/graph-gophers/graphql-go from 0.0.0-20201113091052-beb923fada29 to 1.3.0

Release notes

Sourced from github.com/graph-gophers/graphql-go's releases.

Release v1.3.0

[FEATURE] Support custom panic handler #468

[TESTS] Add more tests for variable validation #470

[FEATURE] Support interfaces implementing interfaces #471

[BUG] Support parsing nanoseconds time properly #486

[BUG] Fix a bug in maxDepth fragment spread logic #492

Release v1.2.0

[FEATURE] Accept custom JSON scalar value as resolver argument (#467)

Release v1.1.0

[FEATURE] Add types package #437

[FEATURE] Expose packer.Unmarshaler as decode.Unmarshaler to the public #450

[FEATURE] Add location fields to type definitions #454

[FEATURE] errors.Errorf preserves original error similar to fmt.Errorf #456

[BUGFIX] Fix duplicated __typename in response (fixes #369) #443

Initial stable release

Changelog

Sourced from github.com/graph-gophers/graphql-go's changelog.

CHANGELOG

v1.5.0 Release v1.5.0

[FEATURE] Add specifiedBy directive in #532

[IMPROVEMENT] In this release we improve validation for primitive values, directives, repeat directives, #515, #516, #525, #527

[IMPROVEMENT] Fix minor unreachable code caused by t.Fatalf #530

[BUG] Fix __type queries sometimes not returning data in #540

[BUG] Allow deprecated directive on arguments by @pavelnikolov in #541

[DOCS] Add array input example #536

v1.4.0 Release v1.4.0

[FEATURE] Add basic first step for Apollo Federation. This does NOT include full subgraph specification. This PR adds support only for _service schema level field. This library is long way from supporting the full sub-graph spec and we do not plan to implement that any time soon.

v1.3.0 Release v1.3.0

[FEATURE] Support custom panic handler #468

[FEATURE] Support interfaces implementing interfaces #471

[BUG] Support parsing nanoseconds time properly #486

[BUG] Fix a bug in maxDepth fragment spread logic #492

v1.2.0 Release v1.2.0

[DOCS] Added examples of how to add JSON map as input scalar type. The goal of this change was to improve documentation #467

v1.1.0 Release v1.1.0

[FEATURE] Add types package #437

[FEATURE] Expose packer.Unmarshaler as decode.Unmarshaler to the public #450

[FEATURE] Add location fields to type definitions #454

[FEATURE] errors.Errorf preserves original error similar to fmt.Errorf #456

[BUGFIX] Fix duplicated __typename in response (fixes #369) #443

v1.0.0 Initial release

Commits

See full diff in compare view

Updates github.com/graphql-go/graphql from 0.7.9 to 0.8.1

Release notes

Sourced from github.com/graphql-go/graphql's releases.

v0.8.1

definition: support thunks for Union.Types definitions @ graphql-go/graphql@0e40a4e

parser: fix infinite recursion in type definition parser @ graphql-go/graphql#637

definition: fix String/Name methods on the List type @ graphql-go/graphql#651

definition: fix: return valid object description @ graphql-go/graphql#653

parser: expose ParseValue @ graphql-go/graphql#656

v0.8.0

subscription: graphql.Subscribe implementation @ graphql-go/graphql#495

language/printer: string quoting fix @ graphql-go/graphql#587

README: replaces https://godoc.org in favor of https://pkg.go.dev links @ graphql-go/graphql#593 & graphql-go/graphql#591

{executor,schema}: use invariantf for performance improvement @ graphql-go/graphql#590

examples/sql-nullstring: fix error handling @ graphql-go/graphql#569

examples: adds http-post example @ graphql-go/graphql#575

examples/todo/schema: TodoSchema @ graphql-go/graphql#574

definition: fix error handling @ graphql-go/graphql#561

util: encoding.TextMarshaler support for BindFields @ graphql-go/graphql#503

graphql: typo fix @ graphql-go/graphql#551

language/printer: description printing support @ graphql-go/graphql#485

Commits

a974186 Merge pull request #642 from Invizory/fix-infinite-recursion-in-parser
2a6e1ff Merge branch 'master' into fix-infinite-recursion-in-parser
623f886 Merge pull request #651 from dariuszkuc/fix_list_name
c18e0b6 Merge branch 'master' into fix_list_name
d264c4c Merge pull request #653 from dariuszkuc/fix_object_description
e9c5c5f Merge branch 'master' into fix_object_description
55311b1 Merge pull request #656 from victor-perov/victor/expose-ParseValue
2ce8c8b Expose ParseValue
fc6b16f fix: return valid object description
ec07c50 fix String/Name methods on the List type
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v4 from 4.13.0 to 4.18.2

Changelog

Sourced from github.com/jackc/pgx/v4's changelog.

4.18.2 (March 4, 2024)

Fix CVE-2024-27289

SQL injection can occur when all of the following conditions are met:

The non-default simple protocol is used.

A placeholder for a numeric value must be immediately preceded by a minus.

There must be a second placeholder for a string value after the first placeholder; both must be on the same line.

Both parameter values must be user-controlled.

Thanks to Paul Gerste for reporting this issue.

Fix CVE-2024-27304

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Thanks to Paul Gerste for reporting this issue.

Fix *dbTx.Exec not checking if it is already closed

4.18.1 (February 27, 2023)

Fix: Support pgx v4 and v5 stdlib in same program (Tomáš Procházka)

4.18.0 (February 11, 2023)

Upgrade pgconn to v1.14.0

Upgrade pgproto3 to v2.3.2

Upgrade pgtype to v1.14.0

Fix query sanitizer when query text contains Unicode replacement character

Fix context with value in BeforeConnect (David Harju)

Support pgx v4 and v5 stdlib in same program (Vitalii Solodilov)

4.17.2 (September 3, 2022)

Fix panic when logging batch error (Tom Möller)

4.17.1 (August 27, 2022)

Upgrade puddle to v1.3.0 - fixes context failing to cancel Acquire when acquire is creating resource which was introduced in v4.17.0 (James Hartig)

Fix atomic alignment on 32-bit platforms

4.17.0 (August 6, 2022)

Upgrade pgconn to v1.13.0

Upgrade pgproto3 to v2.3.1

Upgrade pgtype to v1.12.0

... (truncated)

Commits

14690df Update changelog
779548e Update required Go version to 1.17
80e9662 Update github.com/jackc/pgconn to v1.14.3
0bf9ac3 Fix erroneous test case
f94eb0e Always wrap arguments in parentheses in the SQL sanitizer
826a892 Fix SQL injection via line comment creation in simple protocol
7d882f9 Fix *dbTx.Exec not checking if it is already closed
1d07b8b go mod tidy
13468eb Release v4.18.1
7fed69b simplify duplicate pgx registration guard
Additional commits viewable in compare view

Updates github.com/microcosm-cc/bluemonday from 1.0.4 to 1.0.26

Release notes

Sourced from github.com/microcosm-cc/bluemonday's releases.

Update golang.org/x/net to latest and force latest version

Bumping version and ensuring latest golang.org/x/net as the HTTP rapid reset is triggering primitive vuln scanners, we do not implement a HTTP2 server and are not vulnerable but a minor bump can still help reduce noise for those searching for what they need to upgrade and patch.

Nothing else is in this release aside from the dependency updates and some staticcheck messages being resolved that should not modify behaviour.

Added src rewriter to allow for proxying inline assets.

What's Changed

Bump golang.org/x/net from 0.10.0 to 0.12.0 by @dependabot in microcosm-cc/bluemonday#178

Prefer explicit rules over regexp by @KN4CK3R in microcosm-cc/bluemonday#182

Added src rewriter by @yyewolf in microcosm-cc/bluemonday#179

New Contributors

@yyewolf made their first contribution in microcosm-cc/bluemonday#179

Full Changelog: microcosm-cc/bluemonday@v1.0.24...v1.0.25

Added AllowURLSchemesMatching

This is a feature release, there are no security fixes in this release.

What's Changed

Minor bug fix parsing style attribute with trailing spaces by @sergeyfedotov in microcosm-cc/bluemonday#172

Allow custom URL schemes by matching regex by @yardenshoham in microcosm-cc/bluemonday#175

Bump golang.org/x/net from 0.8.0 to 0.10.0 by @dependabot in microcosm-cc/bluemonday#173

New Contributors

@sergeyfedotov made their first contribution in microcosm-cc/bluemonday#172

@yardenshoham made their first contribution in microcosm-cc/bluemonday#175

Full Changelog: microcosm-cc/bluemonday@v1.0.23...v1.0.24

Resolve golang.org/x/net CVE-2022-41723

What's Changed

Upgrade golang.org/x/net to 0.8.0 by @barshociaj in microcosm-cc/bluemonday#165 to address CVE-2022-41723 which requires updating the x/net dependency

New Contributors

@barshociaj made their first contribution in microcosm-cc/bluemonday#165

Full Changelog: microcosm-cc/bluemonday@v1.0.22...v1.0.23

Add picture to list of elements allowed without attributes

This is not a security update!

This is a usability update as some HTML elements are valid without attributes however the default behaviour is to strip these out of an abundance of caution. The picture element https://developer.mozilla.org/en-US/docs/Web/HTML/Element/picture is one such element where it merely changes the browser rendering such that one of the child elements will be rendered.

The picture element was not present in the allowlist when it should have been, and so this release fixes that as per #161 .

Very minor bug fix to remove empty elements without attributes

Thanks to @Gusted for microcosm-cc/bluemonday#151 which fixes a bug that allowed a policy to be defined in a way that input could've allowed an empty and meaningless element to be left in the output when it should not have done so.

This is not a security issue, and the details can be seen in the PR comment.

... (truncated)

Commits

0eb99d2 Update go.mod to force golang.org/x/net to latest
162f8e5 Merge pull request #193 from microcosm-cc/buro9/update_deps
a50ca5f Update deps and resolve staticcheck messages
c9ef7b1 Hacktober warning
c0ab8c9 Merge pull request #186 from microcosm-cc/dependabot/go_modules/golang.org/x/...
fdaa434 Bump golang.org/x/net from 0.12.0 to 0.14.0
dd1bb0c Retract everything <= 1.0.24
a52260e go-staticcheck fixes
84e9ab4 Updated comment to help teach why proxying inline content is beneficial
fcd58f3 Merge pull request #179 from yyewolf/src-rewrite
Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.11.0 to 1.11.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

1.11.1 / 2022-02-15

[SECURITY FIX] promhttp: Check validity of method and code label values prometheus/client_golang#987 (Addressed CVE-2022-21698)

What's Changed

promhttp: Check validity of method and code label values by @bwplotka and @kakkoyun in prometheus/client_golang#987

Full Changelog: prometheus/client_golang@v1.11.0...v1.11.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

Unreleased

1.19.0 / 2023-02-27

The module prometheus/common v0.48.0 introduced an incompatibility when used together with client_golang (See prometheus/client_golang#1448 for more details). If your project uses client_golang and you want to use prometheus/common v0.48.0 or higher, please update client_golang to v1.19.0.

[CHANGE] Minimum required go version is now 1.20 (we also test client_golang against new 1.22 version). #1445 #1449

[FEATURE] collectors: Add version collector. #1422 #1427

1.18.0 / 2023-12-22

[FEATURE] promlint: Allow creation of custom metric validations. #1311

[FEATURE] Go programs using client_golang can be built in wasip1 OS. #1350

[BUGFIX] histograms: Add timer to reset ASAP after bucket limiting has happened. #1367

[BUGFIX] testutil: Fix comparison of metrics with empty Help strings. #1378

[ENHANCEMENT] Improved performance of MetricVec.WithLabelValues(...). #1360

1.17.0 / 2023-09-27

[CHANGE] Minimum required go version is now 1.19 (we also test client_golang against new 1.21 version). #1325

[FEATURE] Add support for Created Timestamps in Counters, Summaries and Historams. #1313

[ENHANCEMENT] Enable detection of a native histogram without observations. #1314

1.16.0 / 2023-06-15

[BUGFIX] api: Switch to POST for LabelNames, Series, and QueryExemplars. #1252

[BUGFIX] api: Fix undefined execution order in return statements. #1260

[BUGFIX] native histograms: Fix bug in bucket key calculation. #1279

[ENHANCEMENT] Reduce constrainLabels allocations for all metrics. #1272

[ENHANCEMENT] promhttp: Add process start time header for scrape efficiency. #1278

[ENHANCEMENT] promlint: Improve metricUnits runtime. #1286

1.15.1 / 2023-05-3

[BUGFIX] Fixed promhttp.Instrument* handlers wrongly trying to attach exemplar to unsupported metrics (e.g. summary),
causing panics. #1253

1.15.0 / 2023-04-13

[BUGFIX] Fix issue with atomic variables on ppc64le. #1171

[BUGFIX] Support for multiple samples within same metric. #1181

[BUGFIX] Bump golang.org/x/text to v0.3.8 to mitigate CVE-2022-32149. #1187

[ENHANCEMENT] Add exemplars and middleware examples. #1173

[ENHANCEMENT] Add more context to "duplicate label names" error to enable debugging. #1177

[ENHANCEMENT] Add constrained labels and constrained variant for all MetricVecs. #1151

[ENHANCEMENT] Moved away from deprecated github.com/golang/protobuf package. #1183

[ENHANCEMENT] Add possibility to dynamically get label values for http instrumentation. #1066

[ENHANCEMENT] Add ability to Pusher to add custom headers. #1218

[ENHANCEMENT] api: Extend and improve efficiency of json-iterator usage. #1225

[ENHANCEMENT] Added (official) support for go 1.20. #1234

... (truncated)

Commits

989baa3 promhttp: Check validity of method and code label values (#962) (#987)
See full diff in compare view

Updates github.com/russellhaering/goxmldsig from 1.1.1-0.20201210191726-3541f5e554ee to 1.3.0

Commits

See full diff in compare view

Updates github.com/tidwall/gjson from 1.8.1 to 1.9.3

Commits

77a57fd Limit the complexity of "like" queries that match on a pattern.
590010f Update match dependency
61273bf Update dependency
78289be Create FUNDING.yml
75046d2 Update comments
5827eb3 Merge pull request #226 from ifraixedes/if/fix-doc-map-method
807836a Minor update
44b8c19 Minor update to test
160fb9d Updated comments
52919fa Merge pull request #222 from sspaink/arrayindex
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.0.0-20210817164053-32db794688a5 to 0.20.0

Commits

See full diff in compare view

Updates golang.org/x/net from 0.0.0-20210813160813-60bc85c4be6d to 0.21.0

Commits

See full diff in compare view

Updates golang.org/x/sys from 0.0.0-20210823070655-63515b42dcdf to 0.17.0

Commits

See full diff in compare view

Updates google.golang.org/protobuf from 1.27.1 to 1.33.0

Updates k8s.io/apimachinery from 0.17.0 to 0.17.9

Commits

fbe8868 Merge pull request #92970tallclair/automated-cherry-pick-of-#92941
8fbc758 Don't return proxied redirects to the client
f6abbbc Merge pull request #92008apelisse/automated-cherry-pick-of-#91748
48c1ed1 Fix fieldType being dropped by older go-clients
0da7320 Merge pull request #90032apelisse/automated-cherry-pick-of-#89232
891b87d Merge pull request #90020 from liggitt/json-raw-1.17
7378baf Merge pull request #89976 from liggitt/relist-timeout-1.17
6180416 kube-openapi bump to release-1.17
4610e44 Preserve int/float distinction when decoding raw values
bfd932c Fix client watch reestablishment handling of client-side timeouts
Additional commits viewable in compare view

Updates k8s.io/client-go from 0.17.0 to 0.17.16

Commits

6d083d1 Update dependencies to v0.17.16 tag
fac82db Merge pull request #95355sfowl/automated-cherry-pick-of-#95316
ffaa190 Merge pull request #95928ialidzhikov/automated-cherry-pick-of-#80954
19875a3 Mask bearer token in logs when logLevel >= 9
2ea9231 Add lease release tests in leader election
7d1b704 Generate complete leader election record to resolve leader election issues wi...
8df661e Merge pull request #95620roycaihw/automated-cherry-pick-of-#95427
b7e3da0 don't cache transports for incomparable configs
92dd56d Merge pull request #94425gobomb/automated-cherry-pick-of-#93646
59ba4f9 Merge pull request #94149 from liggitt/json-patch-1.17
Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.11.0

What's Changed

git: validate reference names (#929) by @aymanbagabas in go-git/go-git#950

git: stop iterating at oldest shallow when pulling. Fixes #305 by @dhoizner in go-git/go-git#939

plumbing: object, enable renames in getFileStatsFromFilePatches by @djmoch in go-git/go-git#941

storage: filesystem, Add option to set a specific FS for alternates by @pjbgf in go-git/go-git#953

Align worktree validation with upstream and remove build warnings by @pjbgf in go-git/go-git#958

New Contributors

@dhoizner made their first contribution in go-git/go-git#939

@djmoch made their first contribution in go-git/go-git#941

Full Changelog: go-git/go-git@v5.10.1...v5.11.0

v5.10.1

What's Changed

Worktree, ignore ModeSocket files by @steiler in go-git/go-git#930

git: add tracer package by @aymanbagabas in go-git/go-git#916

remote: Flip clause for fast-forward only check by @adityasaky in go-git/go-git#875

plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes #900 by @anandf in go-git/go-git#901

plumbing: uppload-server-info, implement upload-server-info by @aymanbagabas in go-git/go-git#896

plumbing: optimise memory consumption for filesystem storage by @pjbgf in go-git/go-git#799

plumbing: format/packfile, Refactor patch delta by @pjbgf in go-git/go-git#908

plumbing: fix empty uploadpack request error by @aymanbagabas in go-git/go-git#932

plumbing: transport/git, Improve tests error message by @pjbgf in go-git/go-git#752

plumbing: format/pktline, Respect pktline error-line errors by @aymanbagabas in go-git/go-git#936

utils: remove ioutil.Pipe and use std library io.Pipe by @aymanbagabas in go-git/go-git#922

utils: move trace to utils by @aymanbagabas in go-git/go-git#931

cli: separate go module for cli by @aymanbagabas in go-git/go-git#914

build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by @dependabot in go-git/go-git#887

build: bump actions/setup-go from 3 to 4 by @dependabot in go-git/go-git#891

build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by @dependabot in go-git/go-git#888

build: bump actions/checkout from 3 to 4 by @dependabot in go-git/go-git#890

build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by @dependabot in go-git/go-git#907

build: bump golang.org/x/text from 0.13.0 to 0.14.0 by @dependabot in go-git/go-git#906

build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by @dependabot in go-git/go-git#917

build: bump golang.org/x/net from 0.17.0 to 0.18.0 by @dependabot in go-git/go-git#918

New Contributors

@anandf made their first contribution in go-git/go-git#901

@steiler made their first contribution in go-git/go-git#930

Full Changelog: go-git/go-git@v5.10.0...v5.10.1

v5.10.0

What's Changed

PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by @ThinkChaos in go-git/go-git#782

... (truncated)

Commits

5d08d3b Merge pull request #958 from pjbgf/workval
5bd1d8f build: Ensure checkout is the first operation
b2c1982 git: worktree, Align validation with upstream rules
cec7da6 Merge pull request #953 from pjbgf/alternates
8b47ceb storage: filesystem, Add option to set a specific FS for alternates
4f61489 Merge pull request #941 from djmoch/filestats-rename
ae552ce Merge pull request #939 from dhoizner/fix-pull-after-shallow
cc1895b Merge pull request #950 from aymanbagabas/validate-ref
de1d5a5 git: validate reference names
d87110b Merge pull request #948 from go-git/dependabot/go_modules/cli/go-git/github.c...
Additional commits viewable in compare view

Updates github.com/jackc/pgproto3/v2 from 2.1.1 to 2.3.3

Commits

945c212 Backport fixes from pgx v5
0c0f7b0 Add pgx v5 note
f59ff94 UnmarshalJSON: removing hex decode
fd427c0 Don't panic when receiving zero bytes with "slice bounds out of range"
175856f add GSS authentication to pgproto3
c6ccb4b Addressing feedback
e145003 Addressing feedback
1d7886b Adding UTs
fa2b096 fix: Adding overall format before appending ColumnFormatCodes
40ecac4 Remove unimplemented JSON marshalling for FunctionCall type.
Additional commits viewable in compare view

Updates golang.org/x/text from 0.3.6 to 0.14.0

Commits

6c97a16 all: update go directive to 1.18
f488e19 unicode/norm: fix function name on comment
fb697c0 cmd/gotext: actually use -dir flag
f3e69ed cmd/gotext: fix misbehaviors
ab07ad1 all: remove repetitive words
e503480 encoding/japanese, language: shorten very long sub-test names
2df65d7 all: regenerate for Unicode 15.0.0
e3c038a all: prepare for Unicode 15.0.0
3a7a255 internal/export/idna: make more space for mapping index
d61dd50 go.mod: delete repeated "indirect"
Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.40.0 to 1.56.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.56.3

Security

server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.56.2

status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.56.1

client: handle empty address lists correctly in addrConn.updateAddrs

Release 1.56.0

New Features

client: support channel idleness using WithIdleTimeout dial option (#6263)

This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.

client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#6306)

xds: Add support for Custom LB Policies (gRFC A52) (#6224)

xds: support pick_first Custom LB policy (gRFC A62) (#6314) (#6317)

client: add support for pickfirst address shuffling (gRFC A62) (#6311)

xds: Add support for String Matcher Header Matcher in RDS (#6313)

xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#6145)

Special Thanks: @s-matyukevich

xds: enable RLS in xDS by default (#6343)

orca: add support for application_utilization field and missing range checks on several metrics setters

balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#6241)

authz: add conversion of json to RBAC Audit Logging config (#6192)

authz: add support for stdout logger (#6230 and #6298)

authz: support customizable audit functionality for authorization policy (#6192 #6230 #6298 #6158 #6304 and #6225)

Bug Fixes

orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#6245)

xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#6361)

xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#6361)

API Changes

orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#6223)

Release 1.55.1

status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.55.0

Behavior Changes

xds: enable federation support by default (#6151)

status: status.Code and status.FromError handle wrapped errors (#6031 and #6150)

... (truncated)

Commits

1055b48 Update version.go to 1.56.3 (#6713)
5efd7bd server: prohibit more than MaxConcurrentStreams handlers from running at once...
bd1f038 Upgrade version.go to 1.56.3-dev (#6434)
faab873 Update version.go to v1.56.2 (#6432)
6b0b291 status: fix panic when servers return a wrapped error with status OK (#6374) ...
ed56401 [PSM interop] Don't fail target if sub-target already failed (#6390) (#6405)
cd6a794 Update version.go to v1.56.2-dev (#6387)
5b67e5e Update version.go to v1.56.1 (#6386)

…pdates Bumps the go_modules group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/crewjam/saml](https://github.com/crewjam/saml) | `0.4.1` | `0.4.14` | | [github.com/graph-gophers/graphql-go](https://github.com/graph-gophers/graphql-go) | `0.0.0-20201113091052-beb923fada29` | `1.3.0` | | [github.com/graphql-go/graphql](https://github.com/graphql-go/graphql) | `0.7.9` | `0.8.1` | | [github.com/jackc/pgx/v4](https://github.com/jackc/pgx) | `4.13.0` | `4.18.2` | | [github.com/microcosm-cc/bluemonday](https://github.com/microcosm-cc/bluemonday) | `1.0.4` | `1.0.26` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.11.0` | `1.11.1` | | [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.8.1` | `1.9.3` | | google.golang.org/protobuf | `1.27.1` | `1.33.0` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.17.0` | `0.17.9` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.17.0` | `0.17.16` | | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.4.2` | `5.11.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.40.0` | `1.56.3` | Bumps the go_modules group with 1 update in the /dev/sg directory: [github.com/jackc/pgx/v4](https://github.com/jackc/pgx). Bumps the go_modules group with 2 updates in the /lib directory: [golang.org/x/sys](https://github.com/golang/sys) and gopkg.in/yaml.v3. Updates `github.com/crewjam/saml` from 0.4.1 to 0.4.14 - [Commits](crewjam/saml@v0.4.1...v0.4.14) Updates `github.com/graph-gophers/graphql-go` from 0.0.0-20201113091052-beb923fada29 to 1.3.0 - [Release notes](https://github.com/graph-gophers/graphql-go/releases) - [Changelog](https://github.com/graph-gophers/graphql-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/graph-gophers/graphql-go/commits/v1.3.0) Updates `github.com/graphql-go/graphql` from 0.7.9 to 0.8.1 - [Release notes](https://github.com/graphql-go/graphql/releases) - [Commits](graphql-go/graphql@v0.7.9...v0.8.1) Updates `github.com/jackc/pgx/v4` from 4.13.0 to 4.18.2 - [Changelog](https://github.com/jackc/pgx/blob/v4.18.2/CHANGELOG.md) - [Commits](jackc/pgx@v4.13.0...v4.18.2) Updates `github.com/microcosm-cc/bluemonday` from 1.0.4 to 1.0.26 - [Release notes](https://github.com/microcosm-cc/bluemonday/releases) - [Commits](microcosm-cc/bluemonday@v1.0.4...v1.0.26) Updates `github.com/prometheus/client_golang` from 1.11.0 to 1.11.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.11.0...v1.11.1) Updates `github.com/russellhaering/goxmldsig` from 1.1.1-0.20201210191726-3541f5e554ee to 1.3.0 - [Release notes](https://github.com/russellhaering/goxmldsig/releases) - [Commits](https://github.com/russellhaering/goxmldsig/commits/v1.3.0) Updates `github.com/tidwall/gjson` from 1.8.1 to 1.9.3 - [Commits](tidwall/gjson@v1.8.1...v1.9.3) Updates `golang.org/x/crypto` from 0.0.0-20210817164053-32db794688a5 to 0.20.0 - [Commits](https://github.com/golang/crypto/commits/v0.20.0) Updates `golang.org/x/net` from 0.0.0-20210813160813-60bc85c4be6d to 0.21.0 - [Commits](https://github.com/golang/net/commits/v0.21.0) Updates `golang.org/x/sys` from 0.0.0-20210823070655-63515b42dcdf to 0.17.0 - [Commits](https://github.com/golang/sys/commits/v0.1.0) Updates `google.golang.org/protobuf` from 1.27.1 to 1.33.0 Updates `k8s.io/apimachinery` from 0.17.0 to 0.17.9 - [Commits](kubernetes/apimachinery@v0.17.0...v0.17.9) Updates `k8s.io/client-go` from 0.17.0 to 0.17.16 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.17.0...v0.17.16) Updates `github.com/go-git/go-git/v5` from 5.4.2 to 5.11.0 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.4.2...v5.11.0) Updates `github.com/jackc/pgproto3/v2` from 2.1.1 to 2.3.3 - [Commits](jackc/pgproto3@v2.1.1...v2.3.3) Updates `golang.org/x/text` from 0.3.6 to 0.14.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.3.6...v0.14.0) Updates `google.golang.org/grpc` from 1.40.0 to 1.56.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.40.0...v1.56.3) Updates `gopkg.in/yaml.v3` from 3.0.0-20210107192922-496545a6307b to 3.0.1 Updates `github.com/jackc/pgx/v4` from 4.11.0 to 4.18.2 - [Changelog](https://github.com/jackc/pgx/blob/v4.18.2/CHANGELOG.md) - [Commits](jackc/pgx@v4.13.0...v4.18.2) Updates `golang.org/x/sys` from 0.0.0-20210616094352-59db8d763f22 to 0.1.0 - [Commits](https://github.com/golang/sys/commits/v0.1.0) Updates `gopkg.in/yaml.v3` from 3.0.0-20210107192922-496545a6307b to 3.0.0 --- updated-dependencies: - dependency-name: github.com/crewjam/saml dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/graph-gophers/graphql-go dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/graphql-go/graphql dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/jackc/pgx/v4 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/microcosm-cc/bluemonday dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/prometheus/client_golang dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/russellhaering/goxmldsig dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/tidwall/gjson dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/sys dependency-type: direct:production dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-type: direct:production dependency-group: go_modules - dependency-name: k8s.io/apimachinery dependency-type: direct:production dependency-group: go_modules - dependency-name: k8s.io/client-go dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/go-git/go-git/v5 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/jackc/pgproto3/v2 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/text dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-type: indirect dependency-group: go_modules - dependency-name: gopkg.in/yaml.v3 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/jackc/pgx/v4 dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/sys dependency-type: direct:production dependency-group: go_modules - dependency-name: gopkg.in/yaml.v3 dependency-type: direct:production dependency-group: go_modules ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels May 7, 2024

dependabot Bot mentioned this pull request May 7, 2024

build(deps): bump the go_modules group across 3 directories with 18 updates #81

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the go_modules group across 3 directories with 19 updates#83

build(deps): bump the go_modules group across 3 directories with 19 updates#83
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go_modules-a02a442457

dependabot Bot commented on behalf of github May 7, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 7, 2024

Release v1.3.0

Release v1.2.0

Release v1.1.0

v0.8.1

v0.8.0

4.18.2 (March 4, 2024)

4.18.1 (February 27, 2023)

4.18.0 (February 11, 2023)

4.17.2 (September 3, 2022)

4.17.1 (August 27, 2022)

4.17.0 (August 6, 2022)

Update golang.org/x/net to latest and force latest version

Added src rewriter to allow for proxying inline assets.

What's Changed

New Contributors

Added AllowURLSchemesMatching

What's Changed

New Contributors

Resolve golang.org/x/net CVE-2022-41723

What's Changed

New Contributors

Add picture to list of elements allowed without attributes

Very minor bug fix to remove empty elements without attributes

1.11.1 / 2022-02-15

What's Changed

Unreleased

1.19.0 / 2023-02-27

1.18.0 / 2023-12-22

1.17.0 / 2023-09-27

1.16.0 / 2023-06-15

1.15.1 / 2023-05-3

1.15.0 / 2023-04-13

v5.11.0

What's Changed

New Contributors

v5.10.1

What's Changed

New Contributors

v5.10.0

What's Changed

Release 1.56.3

Security

Release 1.56.2

Release 1.56.1

Release 1.56.0

New Features

Bug Fixes

API Changes

Release 1.55.1

Release 1.55.0

Behavior Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Added `src` rewriter to allow for proxying inline assets.

Add `picture` to list of elements allowed without attributes